CVE-2026-107716 · GHSA-556j-vv39-8rqv
Banks: Symlink traversal and arbitrary file disclosure/overwrite in DirectoryPromptRegistry
- Risk score
- 54/100
- CVSS
- 7.3 v4.0
- Exploit chance (30 days)
- 0.1%
- Published
- 8 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- Banks generates meaningful LLM prompts using a simple template language. Prior to 2.5.1, Banks DirectoryPromptRegistry does not reject symbolic links for index.json or discovered and existing .jinja prompt files. In an application where untrusted users can influence a prompt directory, DirectoryPromptRegistry._scan() …
- Affected
- banks (pip) <= 2.5.0
- Fix
- Upgrade banks to 2.5.1 or later.
- Exploitation
- Public proof of concept
Story map
At a glance
banks: Yellow, plan it in. Banks generates meaningful LLM prompts using a simple template language. Prior to 2.5.1, Banks DirectoryPromptRegistry does not reject symbolic links for index.json or discovered and existing .jinja prompt files. In an application where untrusted users can influence a prompt directory, DirectoryPromptRegistry._scan() …
The flaws
- CVE-2026-107716: Banks: Symlink traversal and arbitrary file disclosure/overwrite in DirectoryPromptRegistry (CVSS 7.3 · EPSS 0%)
- CVE-2026-107717: Banks: User-controlled prompt input can be parsed as privileged chat messages (CVSS 6.5 · EPSS 0%)
The fix
Upgrade banks: 2.5.1 · 2.5.0 or later on your release line
Who is exposed: banks (pip) <= 2.5.0
Where it stands
- Public proof of concept
Connects to
- Same weakness: Path traversal (CWE-22). 399 other warnings in 30 days
Why it is Yellow
- CVSS 7.3 high
- Public exploit or proof of concept referenced
- On your watchlist: PyPI
Affected packages
| Package | Ecosystem | Vulnerable | Fixed in |
|---|---|---|---|
| banks | pip | <= 2.5.0 | 2.5.1 |
References
- https://github.com/advisories/GHSA-556j-vv39-8rqv
- https://github.com/masci/banks/security/advisories/GHSA-556j-vv39-8rqv
- https://github.com/masci/banks/pull/79
- https://github.com/masci/banks/commit/23ed13e50b4e217693fa5f9c30943fac8a41582f
- https://github.com/masci/banks/releases/tag/v2.5.1
- https://github.com/advisories/GHSA-556j-vv39-8rqv
Original description
Banks generates meaningful LLM prompts using a simple template language. Prior to 2.5.1, Banks DirectoryPromptRegistry does not reject symbolic links for index.json or discovered and existing .jinja prompt files. In an application where untrusted users can influence a prompt directory, DirectoryPromptRegistry._scan() and DirectoryPromptRegistry.get() can follow a link outside the registry root and disclose a file, while DirectoryPromptRegistry.set(), DirectoryPromptRegistry._save(), and DirectoryPromptRegistry._load() can read or overwrite an external link target. The issue requires attacker influence over the registry directory or its extracted contents. This issue is fixed in version 2.5.1.
Last activity 8 Oct 2026. Patch Forecast updates every hour.